No. Access administration should not move ahead of record reconciliation because teams then lose a reliable source of truth for active privileges and prior decisions. The safer sequence is to confirm entitlement parity first, then shift operational control.
Why the sequence matters for access administration
Access administration depends on accurate entitlement records. If teams move the operating model first, they can grant, revoke, or review access against stale or incomplete data, which makes parity problems harder to detect and easier to institutionalise. Reconciliation is what gives the process a defensible baseline, so the administration function can inherit a trustworthy view of who has what and why.
This is especially important where access is spread across roles, direct entitlements, inherited group membership, or automated joiner-mover-leaver paths. Without reconciliation, administrators may be forced to make decisions on partial evidence, and those decisions become part of the control history that later reviews must untangle.
What goes wrong when administration starts before reconciliation
Early migration usually creates one of two failure patterns: either the new administration process mirrors legacy inaccuracies, or it blocks work while people manually resolve exceptions case by case. In both cases, the organisation loses the ability to distinguish active entitlement from historical residue, so reviewers cannot tell whether an apparent privilege is still justified.
That gap also weakens auditability. If prior approvals, recertifications, and removals are not matched to current records, the team may prove that an action was taken without proving that the entitlement state is correct. A reconciled record set is therefore a control prerequisite, not just a clean-up task.
For governance-heavy access programmes, the same principle is reflected in structured IAM and IGA Basics and in the lifecycle discipline described in the Joiner-Mover-Leaver (JML) Guide. Reconciliation first keeps those processes aligned to current reality instead of legacy drift.
How to decide when the cutover is safe
The practical test is whether the entitlement dataset is complete enough to act as the source of truth for reviews and administration. If the answer is no, the migration should stay in a parallel or read-only phase until the major mismatches are understood, mapped to owners, and resolved. The goal is not perfect data in the abstract, but stable parity for the access decisions the new process will make.
It also helps to separate entitlement reconciliation from role design. A role model can be improved later, but if the baseline records are wrong, the migration will only automate the wrong shape faster. The better sequence is to stabilise the current-state record, then use that verified baseline to simplify future administration.
That approach matches broader access-governance practice in the Access Reviews and Certification Guide and the IGA Buyer’s Guide, both of which assume that entitlement decisions are only as good as the underlying inventory and review data.
Risk and Threat Considerations
When access administration changes before reconciliation, organisations can unintentionally preserve excessive privilege, miss orphaned access, or approve access based on records that no longer reflect operational reality. That creates both governance risk and attack surface, because stale entitlements are harder to spot and easier to abuse during privilege escalation or lateral movement.
Failure mechanism: the new administration workflow becomes the authoritative process before the entitlement baseline is corrected, so incorrect records are treated as valid and are propagated into grants, reviews, and revocations.
Impact: the organisation can lose confidence in access decisions, delay cleanup of unnecessary permissions, and create a longer-lived exposure window for overprivileged accounts or inherited access.
Standards & Framework Alignment
This section maps relevant standards and security frameworks to the operational risks and controls described in this guidance.
NIST SP 800-53 Rev 5 and CIS Controls v8 set the technical controls, while ISO/IEC 27001:2022 defines the regulatory obligations.
| Framework | Control / Reference | Relevance |
|---|---|---|
| NIST SP 800-53 Rev 5 | AC-2 — Account Management | Access administration depends on current account and entitlement state. |
| AC-6 — Least Privilege | Reconciliation helps prevent excess rights from being preserved in the new process. | |
| AU-6 — Audit Record Review, Analysis, and Reporting | Parity checks and prior decisions need reviewable evidence for trustworthy administration. | |
| Recommendation — Reconcile account state before migrating administration controls. Validate effective privileges before cutover and remove excess access. Retain reconciliation evidence so access decisions can be reviewed and challenged. | ||
| CIS Controls v8 | CIS-5 — Account Management | Account and entitlement accuracy must be established before operational control moves. |
| Recommendation — Establish accurate account inventory before shifting access administration. | ||
| ISO/IEC 27001:2022 | A.5.15 — Access control | Access control requires a dependable baseline of who has access to what. |
| A.8.2 — Privileged access rights | Privileged access decisions are especially sensitive to stale entitlement data. | |
| Recommendation — Use reconciled entitlement records as the baseline for access control. Verify privileged access records before migrating administration. | ||
Practitioner Guidance
What to prioritise: reconcile the entitlement inventory first where the migration will change approval, review, or revocation decisions. If you cannot explain the delta between current records and observed access, you do not yet have a safe cutover point.
What to verify: confirm that the reconciled set covers direct grants, inherited membership, service or shared accounts, and any manual exceptions that were previously handled outside workflow. That is the minimum evidence needed to trust the new administration model.
Practitioner takeaway: move the process only after the records are trustworthy, because access administration is a control layer, not a data-cleanup substitute.
Related resources from NHI Mgmt Group
- What should organisations do before expanding AI access to sensitive records?
- How should security teams run access reviews for non-human identities?
- How should security teams govern non-human identities that have persistent access?
- When do NHI access reviews create more value than a one-time cleanup?